cndzmexc[.]one

The domain cndzmexc.one is identified as a brand impersonation threat, specifically targeting the cryptocurrency exchange platform MEXC. The site was designed to mimic MEXC's official website, likely with the intent of harvesting sensitive user data such as account credentials and financial information. The domain's page title, "MEXC," coupled with phishing markers, suggests the use of a drainer kit akin to those used in previous campaigns targeting cryptocurrency platforms.

Technical analysis of the domain cndzmexc.one reveals several indicators of compromise. On VirusTotal, 17 out of 95 security vendors have flagged this domain as malicious. The domain was registered through Gname.com Pte. Ltd. and resolves to the IP address 137.220.131.177, which is located in Japan and associated with Rackip Consultancy Pte. LTD. The domain was created on April 21, 2026, and is registered with a Let's Encrypt SSL certificate using R13. Google Safe Browsing currently marks this domain as phishing, and it is listed on three separate security blocklists due to its malicious activities.

As of the last update, the domain cndzmexc.one has been taken offline, significantly reducing the immediate threat posed to potential victims. The targeted brand, along with security vendors, responded promptly to block the domain across multiple platforms, including PhishDestroy, MetaMask, and SEAL. Despite its offline status, the risk of clone domains emerging remains high. Users are advised to remain vigilant and report any similar domains that emerge. Regular updates to blocklists and enhanced email filtering measures are recommended to prevent future exposure to such threats.